LinuxQuestions.org
Visit Jeremy's Blog.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 03-05-2015, 06:14 AM   #1
yzT!
Member
 
Registered: Jan 2013
Distribution: Debian
Posts: 168

Rep: Reputation: 2
Why installers only offer encryption for LVM?


On all common distros (Debian, openSUSE, Ubuntu, Fedora, Mint...), at installation time you can only choose encryption if you choose to have a LVM setup. But why? Why can't you set a LUKS just on the partition you want without using a LVM setup?
 
Old 03-05-2015, 09:38 AM   #2
/dev/random
Member
 
Registered: Aug 2012
Location: Ontario, Canada
Distribution: Slackware 14.2, LFS-current, NetBSD 6.1.3, OpenIndiana
Posts: 319

Rep: Reputation: 112Reputation: 112
Quote:
Originally Posted by yzT! View Post
On all common distros (Debian, openSUSE, Ubuntu, Fedora, Mint...), at installation time you can only choose encryption if you choose to have a LVM setup. But why? Why can't you set a LUKS just on the partition you want without using a LVM setup?
You can, the problem is now detecting what is a crypt volume and what is not while booting the system, LVM works with LUKS so well because LVM contains everything in a primary volume which then can be encrypted to make everything under it (all partitions encrypted). if you used LUKS on a raw disk how would the boot process unlock the drive? INIT or SYSTEMD have no clue what devices you have, they look at the fstab to mount... problem is adding luks to find and open every volume would be another step... if you really wanted to just rewrite the startup script so it does do it... not really a big deal. Its just not prepackaged, like a lot of things.
 
Old 03-05-2015, 09:55 AM   #3
rknichols
Senior Member
 
Registered: Aug 2009
Distribution: Rocky Linux
Posts: 4,779

Rep: Reputation: 2212Reputation: 2212Reputation: 2212Reputation: 2212Reputation: 2212Reputation: 2212Reputation: 2212Reputation: 2212Reputation: 2212Reputation: 2212Reputation: 2212
I just tried the Fedora 20 installer, and it let me create ordinary partitions with encryption, the only restriction being that the /boot partition cannot be encrypted.
 
Old 03-05-2015, 11:46 AM   #4
sag47
Senior Member
 
Registered: Sep 2009
Location: Raleigh, NC
Distribution: Ubuntu, PopOS, Raspbian
Posts: 1,899
Blog Entries: 36

Rep: Reputation: 477Reputation: 477Reputation: 477Reputation: 477Reputation: 477
Quote:
Originally Posted by rknichols View Post
I just tried the Fedora 20 installer, and it let me create ordinary partitions with encryption, the only restriction being that the /boot partition cannot be encrypted.
That is typically what needs to be done. The /boot partition needs to be the source of truth for how to start the system (including decryption) on a normal partition. The same applies when you're booting your system from software RAID (mdadm). The boot partition has to be on regular non-RAID disk so that it initializes the RAID and boots.

Throwing LVM in the mix does not change that requirement. I believe it is simply a design choice of the maintainers.
 
Old 03-05-2015, 01:43 PM   #5
rknichols
Senior Member
 
Registered: Aug 2009
Distribution: Rocky Linux
Posts: 4,779

Rep: Reputation: 2212Reputation: 2212Reputation: 2212Reputation: 2212Reputation: 2212Reputation: 2212Reputation: 2212Reputation: 2212Reputation: 2212Reputation: 2212Reputation: 2212
Actually, GRUB 2 can handle an encrypted /boot, but I don't know of any installers that set up the GRUB configuration with "GRUB_ENABLE_CRYPTODISK=y". Here is a link to one person's success story.
 
Old 03-05-2015, 11:24 PM   #6
replica9000
Senior Member
 
Registered: Jul 2006
Distribution: Debian Unstable
Posts: 1,126
Blog Entries: 2

Rep: Reputation: 260Reputation: 260Reputation: 260
Quote:
Originally Posted by /dev/random View Post
You can, the problem is now detecting what is a crypt volume and what is not while booting the system, LVM works with LUKS so well because LVM contains everything in a primary volume which then can be encrypted to make everything under it (all partitions encrypted). if you used LUKS on a raw disk how would the boot process unlock the drive? INIT or SYSTEMD have no clue what devices you have, they look at the fstab to mount... problem is adding luks to find and open every volume would be another step... if you really wanted to just rewrite the startup script so it does do it... not really a big deal. Its just not prepackaged, like a lot of things.
This is one of the reasons we use an initrd. For something like cryptsetup, initrd.img will be updated with the UUID of the encrypted volume. No need to check every volume.
 
Old 03-10-2015, 06:31 PM   #7
Blizzard
Member
 
Registered: Oct 2007
Location: Italy
Distribution: Linux Slackware 14.1
Posts: 35

Rep: Reputation: 1
Doesn't Ubuntu installer suggest the ecryptfs encryption, only on the /home mounted fs? ecryptfs doesn't need LVM because it's a filesystem encryption.
LUKS (that is device level encryption) neither needs strictly LVM as far as I know. I've an encrypted Slack installed on common partitions but the root partition needs to be unencrypted (maybe is the boot partition that strictly needs to be in clear?).
My schema is
/ clear
/tmp light encryption (password1)
/home more strong encryption. (password2)

I think that for my security needs (protecting data from hypothetically stolen notebook) having the root in clear does not imply a big risk. So I've not structured my disk with LVM.

have a nice day
Gio
 
Old 03-13-2015, 04:57 AM   #8
yzT!
Member
 
Registered: Jan 2013
Distribution: Debian
Posts: 168

Original Poster
Rep: Reputation: 2
only boot partition need to be unencrypted. Of course you can use LUKS on any filesystem, as it encrypts at block level. In fact, I use LUKS to encrypt stand-alone ext4 and NTFS partitions, and also a LVM.

But my question was why most distros only offered encryption if one decided to go for a LVM.However, with the latest versions this seems to be changing, as rknichols said.
 
Old 03-13-2015, 08:40 AM   #9
fred2014
Member
 
Registered: Mar 2015
Posts: 70

Rep: Reputation: Disabled
Just a question - if the boot partition gets corrupted is there any way to decrypt the data?
 
Old 03-13-2015, 09:55 AM   #10
rknichols
Senior Member
 
Registered: Aug 2009
Distribution: Rocky Linux
Posts: 4,779

Rep: Reputation: 2212Reputation: 2212Reputation: 2212Reputation: 2212Reputation: 2212Reputation: 2212Reputation: 2212Reputation: 2212Reputation: 2212Reputation: 2212Reputation: 2212
Quote:
Originally Posted by fred2014 View Post
Just a question - if the boot partition gets corrupted is there any way to decrypt the data?
If you use a passphrase to unlock the data, then any rescue or installation CD/DVD that supports LUKS (and LVM, if you used it) can be used to unlock and access the partition. If a key file is required, you would of course have to have a copy of that key file available. I've used SystemRescueCD to access LUKS encrypted LVM volumes. In fact, I verified that I could do that before setting up a system that way.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
LXer: Dark Mail Alliance aims to offer Email 3.0, with built-in end-to-end encryption LXer Syndicated Linux News 0 10-31-2013 08:50 PM
Good tutorial for LVM + encryption. cod_liver_0il Slackware 8 09-26-2012 11:27 AM
LVM before and after Encryption? Nemus Linux - Security 3 03-29-2011 10:12 AM
LVM + Encryption + Custom Kernel sparker Slackware 2 08-05-2008 04:47 PM
Alternate CD LVM Encryption Install scrappydoo Ubuntu 0 07-16-2008 06:36 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 05:46 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration